{"answers":{"affected":"1 open source package ship an affected version, including data-pipeline-testmetest.","exploited":"There is no known exploitation of MAL-2026-18177 in the wild and no public exploit code.","fix":"Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.","what":"MAL-2026-18177 is a malicious package in data-pipeline-testmetest, published on 21 Oct 2026."},"fix_prompt":"MAL-2026-18177 is a malicious package: data-pipeline-testmetest (npm). Every version was published to cause harm.\n\nTask:\n1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.\n2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.\n3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.\n4. If the package is not used anywhere, say so and change nothing.\n\nReference: https://insights.sbomify.com/MAL-2026-18177/ (Markdown: https://insights.sbomify.com/MAL-2026-18177/index.md)","id":"MAL-2026-18177","markdown":"https://insights.sbomify.com/MAL-2026-18177/index.md","name":"MAL-2026-18177","record":{"aliases":[],"analysis":null,"analysis_generated_by":null,"assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"data-pipeline-testmetest 2.0.1 is a self-spreading credential stealer that runs on `npm install` without an install script: its `binding.gyp` source `\u003c!(env node index.js \u003e/dev/null 2\u003e\u00261; echo stub.c)` makes node-gyp run `index.js`, an obfuscated loader that decrypts a 939 KB payload and pipes it into Bun (downloaded from GitHub if missing). The payload steals GitHub, npm, PyPI, RubyGems and cloud credentials, commits them to a public repository it creates in the victim's GitHub account (description `project-utils`), and republishes the victim's packages with the same hook. Published by npm account `testnewtestme2` on 2026-10-21.\n\nIf it finds a GitHub token it installs a `net-health-checker` user service that runs `rm -rf ~/` once the token is revoked. Remove `~/.local/bin/net-health-checker.sh` and its systemd unit or LaunchAgent before revoking the token, then rotate all reachable credentials.\n\nThe package ships a binding.gyp whose target type is `none` with no C/C++ sources, and whose `sources` field uses GYP command expansion `\u003c!(env node index.js...; echo stub.c)` to invoke the package's own index.js during the implicit `node-gyp rebuild` that npm runs whenever a binding.gyp is present. This provides install-time code execution without declaring a lifecycle script. index.js is not readable source for the advertised 'test pipeline utilities' purpose: its top-level body is `eval(ROT13(charCodeArray))`, where the decoded code constructs an AES-128-GCM decipher with hardcoded hex key/IV/authTag and executes the resulting ~1.8MB plaintext. The package also declares `bun ^1.2.18` as a runtime dependency, pulling in the Bun runtime installer alongside the obfuscated loader. The combination of a binding.gyp whose only purpose is to run an embedded obfuscated loader, a multi-layer ROT13+AES-GCM-wrapped eval payload with no legible source, and an unrelated alternate-runtime dependency is a loader/dropper structure, not a utility library.","ecosystems":["npm"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":false,"headline":"Malicious code in data-pipeline-testmetest (npm)","id":"MAL-2026-18177","indexable":true,"kev":null,"kind":"malicious","links":{"ecosystem":"npm","product":null,"products":[],"type":null,"year":"2026"},"n_packages":1,"n_references":null,"packages":[{"ecosystem":"npm","fixed":[],"introduced":[],"last_affected":[],"package":"data-pipeline-testmetest","purl":"pkg:npm/data-pipeline-testmetest","source":"MAL-2026-18177"}],"products":null,"published":"2026-10-21","related":[],"sources":[{"class":"attribution","licence":"Apache-2.0","name":"OpenSSF Malicious Packages","prefix":"MAL"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":null,"url":"https://insights.sbomify.com/MAL-2026-18177/"}